Live › vulnerability › CVE-2026-85299
Go to dashboardThe disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine lacked an authorization check. An authenticated attacker can use them to export disk data belonging to other Google Cloud projects.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 10:31 UTC. All times on this page are UTC.
The sources describe this as a flaw in Google's hosted Compute Engine service, patched by Google on 31 August 2026. Customers are not expected to change anything. Teams running on Google Cloud can skip manual action, though they may still review cross-project IAM grants.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data.
This vulnerability was patched on 31 August 2026, and no customer action is needed.
This page as .md · .json · in your agent: get_signal("CVE-2026-85299")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.